General
-
Target
Earings.exe
-
Size
3.2MB
-
Sample
220111-tpm98sgca9
-
MD5
f0651beda340088ea94e3e8cb3fbba9b
-
SHA1
96d7f413100aa077898ba4f8c2ccb68cf641cba7
-
SHA256
1a3cce0f5c02511e834306988d41a92e1fb868af6a460633f9d50a1c18f70342
-
SHA512
e589ee2aaa6ed8d4c6c7f7b16b0d8dc72a8f3a7a7ed14db29b7533935d89cc552d3a6562c7ff8d1a6cde893cdaccf4ee6e6cb14cf60f1ad786c7c5361d348822
Static task
static1
Behavioral task
behavioral1
Sample
Earings.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Earings.exe
Resource
win10-en-20211208
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5095036073:AAEUdbdoQ_lgs7wZgrR-XxCyddDuY92GVFk/sendDocument
Targets
-
-
Target
Earings.exe
-
Size
3.2MB
-
MD5
f0651beda340088ea94e3e8cb3fbba9b
-
SHA1
96d7f413100aa077898ba4f8c2ccb68cf641cba7
-
SHA256
1a3cce0f5c02511e834306988d41a92e1fb868af6a460633f9d50a1c18f70342
-
SHA512
e589ee2aaa6ed8d4c6c7f7b16b0d8dc72a8f3a7a7ed14db29b7533935d89cc552d3a6562c7ff8d1a6cde893cdaccf4ee6e6cb14cf60f1ad786c7c5361d348822
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Accesses Microsoft Outlook profiles
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-